CWE-350

29 CVEs classified under CWE-350. Browse by severity and year.

Top CVEs for CWE-350
CVESeverityScorePublishedSummary
CVE-2026-1490Critical9.82026-02-15The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization…
CVE-2026-42559High8.82026-05-14RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transpo…
CVE-2023-52235High8.82024-04-05SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Reb…
CVE-2018-7160High8.82018-05-17The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possibl…
CVE-2026-55526High8.52026-08-25PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_pag…
CVE-2025-8036High8.12025-07-22Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Fire…
CVE-2017-0902High8.12017-08-31RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and ins…
CVE-2026-56709High7.52026-08-25Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers ca…
CVE-2026-55391High7.52026-07-28datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw J…
CVE-2026-33002High7.52026-03-18Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebS…
CVE-2021-34561High7.52021-08-31In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Atta…
CVE-2021-22884High7.52021-03-03Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not p…
CVE-2026-24281High7.42026-03-07Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof…
CVE-2026-36604Medium6.52026-06-03Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker ca…
CVE-2026-28271Medium6.52026-02-27Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protection…
CVE-2025-61430Medium6.52025-10-24Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server to return request p…
CVE-2025-59956Medium6.52025-09-30AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack w…
CVE-2025-24010Medium6.52025-01-20Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to defa…
CVE-2024-42364Medium6.52024-08-23Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepa…
CVE-2026-75514Medium5.92026-08-20BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blackli…
All CVEs classified under CWE-350 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-55526High8.52026-08-25PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_pag…
CVE-2026-56709High7.52026-08-25Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers ca…
CVE-2026-75514Medium5.92026-08-20BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blackli…
CVE-2026-631182026-07-29MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the…
CVE-2026-55391High7.52026-07-28datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw J…
CVE-2026-46611Medium5.32026-06-25Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does…
CVE-2026-12635Unrated2026-06-25GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain co…
CVE-2026-36604Medium6.52026-06-03Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker ca…
CVE-2026-42559High8.82026-05-14RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transpo…
CVE-2026-6874Medium4.32026-04-23A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token of the component Header Handler. Execut…
CVE-2026-33002High7.52026-03-18Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made through the CLI WebS…
CVE-2026-24281High7.42026-03-07Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof…
CVE-2026-28271Medium6.52026-02-27Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protection…
CVE-2026-1490Critical9.82026-02-15The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization…
CVE-2025-61430Medium6.52025-10-24Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server to return request p…
CVE-2025-59956Medium6.52025-09-30AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack w…
CVE-2025-591632025-09-29vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of HTTP Host and Orig…
CVE-2025-8036High8.12025-07-22Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Fire…
CVE-2025-24010Medium6.52025-01-20Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to defa…
CVE-2024-532752024-12-23Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, the default setup of home-gallery is vul…
CVE-2024-42364Medium6.52024-08-23Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepa…
CVE-2022-22364Medium5.32024-05-03IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to external service interaction attack, caused by improper validation of user-supplied input. A…
CVE-2023-52235High8.82024-04-05SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Reb…
CVE-2023-32020Medium5.62023-06-14Windows DNS Spoofing Vulnerability
CVE-2021-34561High7.52021-08-31In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Atta…
CVE-2021-22884High7.52021-03-03Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not p…
CVE-2020-11091Medium5.82020-06-03In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert…
CVE-2018-7160High8.82018-05-17The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possibl…
CVE-2017-0902High8.12017-08-31RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and ins…